While investigating a system outage, a coworker was discussing looking for what was missing as opposed to what was present in the log files. That didn’t seem to make much sense to me initially. To illustrate his point he recalled a story from World War II. Many of the allied planes were being shot down and the ones that returned to the base were very badly damaged. A group of scientists were tasked with figuring out which parts of the planes needed extra armour to make it back home. Most scientist chose to add armour in places where the planes that returned to the base had the most bullet holes. The very fact that these planes returned to the base implied that the locations where they were shot in were not catastrophic. Hence the location of the current bullet holes were not the locations to re-enforce. But their first reaction was to be biased to what was present not what was absent. What they really needed was to examine a plane that did not make it back to the base.